Method, apparatus and program storage device for extending dispersion frame technique behavior using dynamic rule sets

ABSTRACT

A method, apparatus and program storage device for providing control of statistical processing of error data over a multitude of sources using a dynamically modifiable DFT rule set is disclosed. The dispersion frame technique is extended in the present invention to provide dispersion frame rules with user-defined parameters thereby creating a dynamically modifiable rule set.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This disclosure relates in general to processing error data, and moreparticularly to a method, apparatus and program storage device forproviding control of statistical processing of error data over amultitude of sources using a dynamically modifiable DFT rule set.

2. Description of Related Art

As consumers become more dependent on computer systems to performreliable tasks, tolerance for computer system errors decreases. Computersystems typically experience outages when soft failures occur. Ashardware ages an increasing number of computer errors occur, and thelikelihood of soft failure increases. Without safety mechanisms computersystems inevitably experience failure resulting in user dissatisfaction.

In order to avoid computer system failure, methods for predicting ordiagnosing an impending system failure have been developed. For example,a specification-based diagnosis of system failure is a method fordetermining what the expected behavior of a system will be based onsystem design specifications under defined operating conditions. Testsbased on expected system behavior are developed and used to diagnosesystem failure. The specification-based diagnosis approach, however, haslimited abilities in isolating unanticipated faults and in developingtests for diagnosing unanticipated faults.

Another example of a mechanism for diagnosing system failure is thesymptoms-based diagnosis. System fault conditions are identifiedsymptomatically by reconstructing system failures using event or errorlogs to identify the circumstances where errors occurred and evaluatingthe circumstances surrounding the errors leading up to system failure.The symptoms-based diagnosis approach results in system failureindicators rather than tests like the specification-based diagnosisapproach.

A particular example of a symptoms-based diagnosis technique is thedispersion frame technique (DFT) that was developed based on theobservation that computer systems and other electronic devicesexperience an increasing error rate prior to catastrophic failure. TheDFT technique uses rules to determine the relationship between erroroccurrences by examining their closeness in time and space. ExtendingDFT rules augments the functionality of a DFT engine and allows atighter control of statistical processing of error data over a multitudeof computer devices. The rules also allow significant increments inerror rate occurring within a specified time frame to be viewed as asingle error event. The single error event is only recognized if theincrement exceeds a specified watermark defined by the rule. Methodsusing the DFT use rules that are static, however, and only provides asingle dimension of statistical analysis.

It can be seen that there is a need for a method, apparatus and programstorage device for providing and implementing a dynamically modifiableDFT rule set.

SUMMARY OF THE INVENTION

To overcome the limitations described above, and to overcome otherlimitations that will become apparent upon reading and understanding thepresent specification, the present invention discloses a method,apparatus and program storage device for providing control ofstatistical processing of error data over a multitude of sources using adynamically modifiable DFT rule set.

The present invention solves the above-described problems by extendingthe dispersion frame technique to provide dispersion frame rules withuser-defined parameters thereby creating a dynamically modifiable ruleset to allow a DFT engine to work within varying ranges of data.

A method for providing error data processing having user-definedparameters includes applying user-defined error thresholds to aplurality of user-definable error threshold rules, processing errorevents, storing information related to the processed error events anddetermining when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored information.

In another embodiment of the present invention, a computing device foruse in an error data processing system is provided. The computing deviceincludes a memory for storing error information and a processor, coupledto the memory, for applying user defined error threshold data to aplurality of user-definable error threshold rules and determining whenone of the plurality of user-definable error threshold rules has beensatisfied based on the stored error information.

In another embodiment of the present invention, a method for providingerror data processing having user-defined parameters is provided. Themethod includes applying user-defined error thresholds to a plurality ofuser-definable error threshold rules, detecting a plurality of errorsfrom a source, calculating a time period between the plurality oferrors, storing information related to the plurality of errors and thetime periods between the plurality of errors and determining when one ofthe plurality of user-definable error threshold rules has been satisfiedbased on the stored information.

In another embodiment of the present invention, a computing device foruse in an error data processing system is provided. The computing deviceincludes a memory for storing error information, the error informationrelated to error source and error interarrival time and a processor,coupled to the memory, for applying user defined error threshold data toa plurality of user-definable error threshold rules, determining whenone of the plurality of user-definable error threshold rules has beensatisfied based on the stored error source and error interarrival time.

In another embodiment of the present invention, a program storage deviceis provided. The program storage device includes program instructionsexecutable by a processing device to perform operations for providingerror data processing having user-defined parameters, the operationsincluding applying user-defined error thresholds to a plurality ofuser-definable error threshold rules, processing error events, storinginformation related to the processed error events and determining whenone of the plurality of user-definable error threshold rules has beensatisfied based on the stored information.

In another embodiment of the present invention, a program storage deviceis provided. The program storage device includes program instructionsexecutable by a processing device to perform operations for providingerror data processing having user-defined parameters, the operationsincluding applying user-defined error thresholds to a plurality ofuser-definable error threshold rules, detecting a plurality of errorsfrom a source, calculating a time period between the plurality oferrors, storing information related to the plurality of errors and thetime periods between the plurality of errors and determining when one ofthe plurality of user-definable error threshold rules has been satisfiedbased on the stored information.

In another embodiment of the present invention, a computing device foruse in an error data processing system is provided. The computing deviceincludes means for storing error information and means, coupled to themeans for storing, for applying user defined error threshold data to aplurality of user-definable error threshold rules and determining whenone of the plurality of user-definable error threshold rules has beensatisfied based on the stored error information.

These and various other advantages and features of novelty whichcharacterize the invention are pointed out with particularity in theclaims annexed hereto and form a part hereof. However, for a betterunderstanding of the invention, its advantages, and the objects obtainedby its use, reference should be made to the drawings which form afurther part hereof, and to accompanying descriptive matter, in whichthere are illustrated and described specific examples of an apparatus inaccordance with the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Referring now to the drawings in which like reference numbers representcorresponding parts throughout:

FIG. 1 shows a network of data processing system in which the presentinvention may be implemented;

FIG. 2 is a block diagram of a computer processing system that may beimplemented as a server or computer system as shown in FIG. 1;

FIG. 3 is a graph that schematically illustrates error events on atimeline for illustrating implementation of an embodiment of the presentinvention;

FIG. 4 is a flowchart of a method for error data processing inaccordance with an embodiment of the present invention;

FIG. 5 is a flowchart of a method for providing an extended dispersionframe technique (DFT) rule set with user-defined parameters inaccordance with an embodiment of the present invention; and

FIG. 6 illustrates a flowchart of a method for processing errorsaccording to an extended DFT rule set in accordance with embodiments ofthe invention.

DETAILED DESCRIPTION OF THE INVENTION

In the following description of the embodiments, reference is made tothe accompanying drawings that form a part hereof, and in which is shownby way of illustration the specific embodiments in which the inventionmay be practiced. It is to be understood that other embodiments may beutilized because structural changes may be made without departing fromthe scope of the present invention.

An embodiment of the present invention provides a method, apparatus andprogram storage device for providing control of statistical processingof error data over a multitude of sources using a dynamically modifiableDFT rule set. The dispersion frame technique is extended in the presentinvention to provide dispersion frame rules with user-definedparameters, creating a dynamically modifiable rule set.

FIG. 1 shows a network of data processing system 100 in which thepresent invention may be implemented. Network data processing system 100includes a network 102, which is the medium used to providecommunications links between various devices and computers connectedtogether within network data processing system 100. Network 102 mayinclude connections, such as wire, wireless communication links, orfiber optic cables.

In the depicted example, server 104 is connected to network 102 alongwith storage unit 106. In addition, clients 108, 110, and 112 areconnected to network 102. These clients 108, 110, and 112 may be, forexample, personal computers, network computers or workstations. In FIG.1, server 104 provides data, such as boot files, operating systemimages, and applications to clients 108-112. Clients 108, 110, and 112are clients to server 104. Network data processing system 100 mayinclude additional servers, clients, and other devices not shown.

FIG. 2 is a block diagram of a computer processing system 200 that maybe implemented as a server or computer system as shown in FIG. 1.Computer processing system 200 may be a symmetric multiprocessor (SMP)system including a plurality of processors 202 and 204 connected tosystem bus 206. Alternatively, a single processor system may beemployed. Also connected to system bus 206 is memory controller/cache208, which provides an interface to local memory 209. I/O bus bridge 210is connected to system bus 206 and provides an interface to I/O bus 212.Memory controller/cache 208 and I/O bus bridge 210 may be integrated asdepicted.

Peripheral component interconnect (PCI) bus bridge 214 connected to I/Obus 212 provides an interface to PCI local bus 216. A number ofcommunication devices 218 may be connected to PCI local bus 216. TypicalPCI bus implementations will support four PCI expansion slots or add-inconnectors. Communications links to clients 108-112 in FIG. 1 may beprovided through communication device 218 and network adapter 220connected to PCI local bus 216 through add-in boards.

Additional PCI bus bridges 222 and 224 provide interfaces for additionalPCI local buses 226 and 228, from which additional modems or networkadapters may be supported. In this manner, computer processing system200 allows connections to multiple network computers. A memory-mappedgraphics adapter 230 and hard disk 232 may also be connected to I/O bus212 as depicted, either directly or indirectly.

Those of ordinary skill in the art will appreciate that the hardwaredepicted in FIG. 2 may vary. For example, other peripheral devices, suchas optical disk drives and the like, also may be used in addition to orin place of the hardware depicted. Further, the types of buses may bedifferent. The depicted example is not meant to imply architecturallimitations with respect to embodiments of the present invention.

As described earlier, system fault conditions may be identifiedsymptomatically by reconstructing system failures using event or errorlogs to identify the circumstances where errors occurred and evaluatingthe circumstances surrounding the errors leading up to system failure.The symptoms-based diagnosis approach results in system failureindicators rather than tests like the specification-based diagnosisapproach. A particular example of a symptoms-based diagnosis techniqueis the dispersion frame technique (DFT) that was developed based on theobservation that computer systems and other electronic devicesexperience an increasing error rate prior to catastrophic failure. TheDFT technique uses rules to determine the relationship between erroroccurrences by examining their closeness in time and space. The DFT ruleset is illustrated in Table 1 below. TABLE 1 Dispersion Frame Rules 3.3Rule When two consecutive EDIs from successive application of the samedispersion frame exhibit an EDI of at least 3. 2.2 Rule When twoconsecutive EDIs from two successive dispersion frames exhibit an EDI ofat least 2. 2 in 1 Rule When a dispersion frame is less than one hour. 4in 1 Rule When four error events occur within a 24 hour frame. 4Decreasing When there are four monotonically Rule decreasing dispersionframes and at least one frame is half the size of its previous frame.

Methods using the DFT use rules that are static as shown in Table 1.However, static rules only provide a single dimension of statisticalanalysis. For example, as shown in Table 1, a typical dispersion frametechnique (DFT) provides five statistical rules. Error dispersionindicies (EDIs) are the number of error occurrences in half of adispersion frame. Dispersion frames are defined by interarrival times orthe time between successive error events of the same type. A first rulecovers when two consecutive Error dispersion indicies (EDIs) fromsuccessive applications of the same dispersion frame exhibit an EDI ofat least 3 (3.3 Rule). A second rule covers when two consecutive EDIsfrom two successive dispersion frames exhibit an EDI of at least 2 (2.2Rule). A third rule covers when a dispersion frame is less than one hour(2 in 1 Rule). A fourth rule covers when four error events occur withina 24-hour time frame (4 in 1 Rule). A fifth rule covers when there arefour monotonically decreasing dispersion frames and at least one frameis half the size of its previous frame (4 Decreasing Rule). Accordingly,these rules may be used for determining the relationship between erroroccurrences by examining their type and closeness in time and space.

DFT utilizes a model based on the interarrival times of observationswithin a dispersion frame. Based on the experience gained in factoringerror logs into individual error sources, the predictive failureanalysis (PFA) engine extracts, organizes, and examines the error logentries from a persistent storage medium. The organization of the Rulesapplies one of its five failure prediction rules according to theinterarrival patterns of the errors. The five rules capture behaviorcorresponding to that detected by traditional statistical analysismethods within a dispersion frame. The PFA engine determines therelationship between error occurrences by examining their closeness intime (duration) and space (affected area).

More particularly, the 3.3 Rule focuses on examining consecutive EDIsfrom the same dispersion frame. When successive applications of thedispersion frame yields an EDI of at least three a warning correspondingto the 3.3 Rule is sent. The 3.3 Rule has requirements of twoconsecutive EDIs, and an EDI of at least three. These requirementsremain static in the DFT rule set.

The 2.2 Rule focuses on examining successive dispersion frames and theEDIs within the dispersion frames. When two dispersion frames have anEDI of at least two, the warning connected with the 2.2 Rule is sent.Similar to the 3.3 Rule, the 2.2 Rule has static requirements. Here therequirements are two consecutive EDIs in consecutive dispersion frames,and an EDI of at least two.

In the 2 in 1 and 4 in 1 Rule, focus is placed on the time span betweenerror events. The 2 in 1 rule is satisfied when a dispersion frame, orthe interarrival time between errors, spans a time of less than onehour. The 4 in 1 rule is satisfied when four error events occur withinthe span of one day. Each of the 2 in 1 and 4 in 1 Rules includes anunchanging time requirement and detected error requirement.

The 4 decreasing rule focuses on the time span between dispersion framesand the rate at which the errors are occurring. In the 4 decreasing rulea warning is sent after four dispersion frames are the same size orsmaller than the previous dispersion frames and one of the frames ishalf the size of the previous dispersion frame. The 4 decreasing Ruleincludes static requirements of four dispersion frames be the same sizeor smaller than the previous dispersion frame and one dispersion framebe half the size of the previous dispersion frame.

FIG. 3 illustrates a graph 300 that schematically illustrates events ona timeline leading up to a 3.3 Rule warning, 2.2 Rule warning and a 4Decreasing Rule warning. Error events i-4, i-3, i-2, i-1 and i areshown. A Dispersion Frame is defined as the interarrival time betweensuccessive error events of the same type. Thus, interarrival time is thetime period between two error events. Dispersion Frame (i-3) 310 is theinterarrival time between events i-4 and i-3. Frame (i-2) 320 is thedispersion frame between events i-3 and i-2.

The number of errors from the center to the right end of each frame ismeasured and designated as the Error Dispersion Index (EDI). An EDI forframe (i-3) 310 is 3, and frame (i-2) 320 is 2. An example of this wouldbe frame (i-3) 310 is the time between errors i-3 and i-2.

With respect to the 3.3 Rule, in frame (i-3) 310 the EDI for twoconsecutive indicies 305 and 315 within applications of the same frameis three. The 3.3 Rule is satisfied by the time and space between errorevents requirements and the 3.3 Rule warning 311 is sent.

With respect to the 2.2 Rule, between frames (i-3) 310 and (i-2) 320,consecutive indicies have an EDI of at least two. The time span 315 nextto Frame (i-2) of Frame (i-3) has an index of 3, and the time span 325next to Frame (i-3) of Frame (i-2) has an index of 2. The time and spacerequirements for the 2.2 Rule are satisfied and a warning 322corresponding to the 2.2 Rule is issued.

In viewing Frames (i-3) to (i), it can be seen that the four Frames(i-3) 310, (i-2) 320, (i-1) 330 and (i) 340 decrease or remain the samein size over time, and of the four frames, at least one frame (i) 340 ishalf the size of the previous frame (i-1) 330. Thus, the 4 DecreasingRule 344 is satisfied. The above-mentioned DFT rules are static and onlyprovide a single dimension of statistical analysis, however.

FIG. 4 is a flowchart 400 of providing a rule set having user-definedparameters for error data processing in accordance with embodiments ofthe present invention. User-defined error thresholds are received 410and error threshold rules are set 420 according to the user-define errorthresholds. Errors are detected and information related to the errors isstored 430. Stored information is compared 440 the threshold rules and adetermination is made about whether an error threshold has been met 450.When an error threshold has not been met the engine driving the rule setcontinues to process and store 430 detected errors and compare 440 thestored information until an error threshold has been met. Once an errorthreshold has been reached a warning is sent 460.

The DFT rules described above are modified in embodiments of the presentinvention and assigned to devices having unique patterns. Theuser-defined rules are received as input to the extended DFT processingengine explained below. In accordance with embodiments of the invention,the extended DFT rule set is illustrated in Table 2. TABLE 2 ExtendedDispersion Frame Rules 3.3 Rule When X consecutive EDIs from successiveapplication of the same dispersion frame exhibit an EDI of at least Y.2.2 Rule When X consecutive EDIs from two successive dispersion framesexhibit an EDI of at least Y. 2 in 1 Rule When a dispersion frame isless than N time frame. 4 in 1 Rule When four error events occur withinN time frame. 4 Decreasing When there are X monotonically Ruledecreasing dispersion frames and at least Y frame(s) is half the size ofits previous frame.

Similar to Table 1, error dispersion indicies (EDIs) are the number oferror occurrences in half of a dispersion frame. Dispersion frames aredefined by interarrival times between successive error events of thesame type.

FIG. 5 is a flowchart 500 illustrating providing an extended dispersionframe rule set with user-defined parameters in accordance withembodiments of the present invention. Extended dispersion frame rulesare user-defined and received 505. Each variable is set 510 within therule set. The variables include: the time frames for the 2 in 1 and 4 in1 Rule, the number of required error occurrences for the 4 in 1 Rule,the required EDI number for the 3.3 and 2.2 Rule, the number of requiredconsecutive indicies for the 3.3 and 2.2 Rule, the number of frames forthe 4 Decreasing rule, and the number of frames required to be half thesize of the previous frame for the 4 Decreasing Rule. Dispersion framesare identified 515 and compared with the extended dispersion frame ruleset having user-defined parameters.

With respect to the 3.3 Rule, a comparison 520 is made between the 3.3Rule requirements. When a user-defined number of EDIs from successiveapplications of the same dispersion frame have at least a user-definedEDI number, the threshold for the 3.3 Rule is satisfied 530 and awarning associated with satisfying the 3.3 Rule is sent 535.

For the 2.2 Rule, the plurality of errors are compared 520 to the 2.2Rule requirements having user-defined parameters. When a user-definednumber of consecutive EDIs from two successive frames exhibit at least auser-defined EDI number, the 2.2 Rule requirements are satisfied 540 andan associated 2.2 Rule warning is sent 545.

For the 2 in 1 Rule, the time frame between the plurality of errors iscompared 520 with the user-defined 2 in 1 rule time frame. When errorsare received within the defined time frame the 2 in 1 Rule is satisfied550 and a 2 in 1 error message is sent 555.

For the 4 in 1 Rule, the time between a user-defined number of errorsmust fall within a user-defined time frame. When the stored errorinformation is compared 520 with the 4 in 1 Rule user-definedrequirements, and the requirements are met 560, a 4 in 1 error messageis sent 565.

In a 4 Decreasing Rule scenario, a user-defined number of dispersionframes monotonically decreases and a user-defined number of thedispersion frames are half the size as the previous dispersion frame.The error data is compared 520 with the user-defined 4 Decreasing Rule,and when the 4 Decreasing Rule requirements are satisfied 570 an errormessage is sent 575 associated with the 4 Decreasing Rule.

In instances where the above-mentioned rules are not satisfied, theprocess cycles back to identifying 505 dispersion frames from memoryuntil the rule requirements are met.

FIG. 6 illustrates a flowchart 600 of a method for processing errorsaccording to an extended DFT rule set according to an embodiment of thepresent invention. A plurality of errors is detected 605 from a source.A time period between errors is determined 610 and information relatedto the errors is stored 615. Each of the extended DFT rules are compared620, 630, 640, 650 and 660 with the stored error data. A determinationis made whether the extended DFT rules are satisfied 625, 635, 645, 655and 665. And for each of the extended DFT rules that are satisfied, awarning is sent 628, 638, 648, 658 and 668 associated with theparticular rule satisfied. In instances where the rule set requirementsare not met the process returns to the step where a plurality of errorsis detected 605.

Referring again to FIG. 2, a suitable computing system environment 200according to an embodiment of the present invention. For example, theenvironment 200 can be a client, a data server, and/or a master serverthat has been described. The computing system environment 200 is onlyone example of a suitable computing environment and is not intended tosuggest any limitation as to the scope of use or functionality of theinvention. Neither should the computing environment 200 be interpretedas having any dependency or requirement relating to any one orcombination of components illustrated in the exemplary operatingenvironment 200. In particular, the environment 200 is an example of acomputerized device that can implement the servers, clients, or othernodes that have been described.

Computer storage media includes volatile, nonvolatile, removable, andnon-removable media implemented in any method or technology for storageof information such as computer readable instructions, data structures,program modules, or other data. Memory 209, 208, storage, for exampleattached to PCI bus 226, 228 and/or hard drive 232 are all examples ofcomputer storage media. Computer storage media includes, but is notlimited to, RAM, ROM, EEPROM, flash memory or other memory technology,CDROM, digital versatile disks (DVD) or other optical storage, magneticcassettes, magnetic tape, magnetic disk storage or other magneticstorage devices, or any other medium which can be used to store thedesired information and which can accessed by device 200. Any suchcomputer storage media may be part of device 200.

Device 200 may also contain communications connection(s) 218 that allowthe device to communicate with other devices. Communicationsconnection(s) 218 is an example of communication media. Communicationmedia typically embodies computer readable instructions, datastructures, program modules, or other data in a modulated data signalsuch as a carrier wave or other transport mechanism and includes anyinformation delivery media. The term “modulated data signal” means asignal that has at least one of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wired media such as awired network or direct-wired connection, and wireless media such asacoustic, RF, infrared and other wireless media. The term computerreadable media as used herein includes both storage media andcommunication media.

The methods that have been described can be computer-implemented on thedevice 200. A computer-implemented method is desirably realized at leastin part as at least one programs running on a computer. The programs canbe executed from a computer-readable medium such as a memory by aprocessor of a computer. The programs are desirably storable on amachine-readable medium, such as a floppy disk or a CD-ROM, fordistribution and installation and execution on another computer. Theprogram or programs can be a part of a computer system, a computer, or acomputerized device.

In further embodiments of the invention the extended DFT rules allowsignificant increments in error rate occurring within a specified timeframe, to be viewed as a single error event. The single error event isonly recognized, however, if the increment exceeds a specified watermarkdefined by the rule.

Embodiments of the invention provide a convention to dynamically modifythe extended DFT rules. This forces the DFT to work within varyingranges of data specified by the user. These varying ranges can also beapplied to specific hardware elements that are being monitored and havethe ability to report errors. Users of the extended DFT will have theflexibility to set tighter statistical constraints and tune the DFTengine to function across varying processing environments.

The foregoing description of the exemplary embodiment of the inventionhas been presented for the purposes of illustration and description. Itis not intended to be exhaustive or to limit the invention to theprecise form disclosed. Many modifications and variations are possiblein light of the above teaching. It is intended that the scope of theinvention be limited not with this detailed description, but rather bythe claims appended hereto.

1. A method for providing error data processing having user-definedparameters, comprising: applying user-defined error thresholds to aplurality of user-definable error threshold rules; processing errorevents; storing information related to the processed error events; anddetermining when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored information.
 2. The methodof claim 1, wherein the processing error events comprises: detecting aplurality of errors from a source; and calculating a time period betweenthe plurality of errors.
 3. The method of claim 2, wherein the storinginformation related to the processed error events further comprisesstoring information related to the plurality of errors and the timeperiods between the plurality of errors.
 4. The method of claim 2,wherein the determining when one of the plurality of user-definableerror threshold rules has been satisfied further comprises comparing anumber of detected errors and the time period between the plurality oferrors to the user-definable error threshold rules.
 5. The method ofclaim 2, wherein determining when one of the plurality of user-definableerror threshold rules has been satisfied based on the stored informationcomprises determining that the detected plurality of errors satisfies auser-defined error dispersion index number, wherein the error dispersionindex is the number of errors in half of the time period between errorsof the same type.
 6. The method of claim 5 further comprising reachingthe user-defined error dispersion index number a user-defined numbertimes consecutively in the same period of time between errors of thesame type.
 7. The method of claim 6 further comprising satisfying theuser-defined error dispersion index number a user-defined number oftimes consecutively in two successive dispersion frames.
 8. The methodof claim 1, wherein the detecting the plurality of errors comprisesprocessing errors occurring within a user-defined time frame andidentifying the errors as one error when an error rate based on thecalculated time period between the plurality of errors satisfies auser-definable error threshold rule.
 9. The method of claim 1 furthercomprising sending a warning when one of the plurality of user-definableerror threshold rules has been satisfied.
 10. The method of claim 9,wherein the warning is of a particular type based on the one of theplurality of user-definable error threshold rules.
 11. The method ofclaim 1 further comprising providing user-defined error thresholds formodifying the user-definable error threshold rules.
 12. The method ofclaim 1, wherein determining when one of the plurality of user-definableerror threshold rules has been satisfied based on the stored informationcomprises determining that the period of time between detected errors isless than a user-defined time frame.
 13. The method of claim 1, whereindetermining when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored information comprisesdetermining that a user-defined number of detected errors occur within auser-defined time frame.
 14. The method of claim 1, wherein determiningwhen one of the plurality of user-definable error threshold rules hasbeen satisfied based on the stored information comprises determiningthat a user-defined number of periods of time between errors occurs at anon-increasing rate.
 15. The method of claim 14, wherein errorsoccurring at a non-increasing rate further comprises a user-definednumber of errors occurring within half of the previous period of timebetween errors.
 16. A computing device for use in an error dataprocessing system, comprising: a memory for storing error information;and a processor, coupled to the memory, for applying user defined errorthreshold data to a plurality of user-definable error threshold rulesand determining when one of the plurality of user-definable errorthreshold rules has been satisfied based on the stored errorinformation.
 17. The computing device of claim 16, wherein the errorinformation comprises information related to error interarrival time.18. The computing device of claim 16, wherein the processor sends awarning when one of the plurality of user-definable error thresholdrules has been satisfied.
 19. The computing device of claim 18, whereinthe warning comprises a particular warning type based on the one of theplurality of error thresholds satisfied.
 20. The computing device ofclaim 16, wherein the stored error information comprises error eventsrepresenting detected errors and interarrival times associated with thedetected errors.
 21. The computing device of claim 20, wherein theprocessor determines when one of the plurality of user-definable errorthreshold rules has been satisfied by comparing a number of detectederrors and the time period between the plurality of errors to theuser-definable error threshold rules.
 22. The computing device of claim16, wherein the processor modifies the user-definable error thresholdrules based on received user-defined error thresholds.
 23. The computingdevice of claim 16, wherein the processor determines when one of theplurality of user-definable error threshold rules has been satisfied bydetecting errors occurring within a user-defined time frame andidentifying the errors as one error when an error rate based on acalculated time period between the plurality of errors satisfies auser-definable error threshold rule.
 24. The computing device of claim23, wherein the processor determines that the detected plurality oferrors satisfies a user-defined error dispersion index number, whereinthe error dispersion index is the number of errors in half of the timeperiod between errors of the same type.
 25. The computing device ofclaim 16, wherein the processor determines when one of the plurality ofuser-definable error threshold rules has been satisfied based on thestored information by determining that the period of time betweendetected errors is less than a user-defined time frame.
 26. Thecomputing device of claim 16, wherein the processor determines when oneof the plurality of user-definable error threshold rules has beensatisfied based on the stored information by determining that auser-defined number of detected errors occur within a user-defined timeframe.
 27. The computing device of claim 16, wherein the processordetermines when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored information by determiningthat a user-defined number of periods of time between errors occurs at anon-increasing rate.
 28. A method for providing error data processinghaving user-defined parameters, comprising: applying user-defined errorthresholds to a plurality of user-definable error threshold rules;detecting a plurality of errors from a source; calculating a time periodbetween the plurality of errors; storing information related to theplurality of errors and the time periods between the plurality oferrors; and determining when one of the plurality of user-definableerror threshold rules has been satisfied based on the storedinformation.
 29. A computing device for use in an error data processingsystem, comprising: a memory for storing error information, the errorinformation related to error source and error interarrival time; and aprocessor, coupled to the memory, for applying user defined errorthreshold data to a plurality of user-definable error threshold rules,determining when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored error source and errorinterarrival time.
 30. A program storage device, comprising: programinstructions executable by a processing device to perform operations forproviding error data processing having user-defined parameters, theoperations comprising: applying user-defined error thresholds to aplurality of user-definable error threshold rules; processing errorevents; storing information related to the processed error events; anddetermining when one of the plurality of user-definable error thresholdrules has been satisfied based on the stored information.
 31. A programstorage device, comprising: program instructions executable by aprocessing device to perform operations for providing error dataprocessing having user-defined parameters, the operations comprising:applying user-defined error thresholds to a plurality of user-definableerror threshold rules; detecting a plurality of errors from a source;calculating a time period between the plurality of errors; storinginformation related to the plurality of errors and the time periodsbetween the plurality of errors; and determining when one of theplurality of user-definable error threshold rules has been satisfiedbased on the stored information.
 32. A computing device for use in anerror data processing system, comprising: means for storing errorinformation; and means, coupled to the means for storing, for applyinguser defined error threshold data to a plurality of user-definable errorthreshold rules and determining when one of the plurality ofuser-definable error threshold rules has been satisfied based on thestored error information.